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Abstract 



Consider a Boolean function x '■ X — > {0, 1} that partitions set 
X between its good and bad elements, where x is good if x( x ) = 1 
and bad otherwise. Consider also a quantum algorithm A such that 
-4|0) = Ylx&x a x\ x ) 1S a quantum superposition of the elements of X, 
and let a denote the probability that a good element is produced if 
A\0) is measured. If we repeat the process of running A, measuring 
the output, and using \ to check the validity of the result, we shall 
expect to repeat 1/a times on the average before a solution is found. 
Amplitude amplification is a process that allows to find a good x after 
an expected number of applications of A and its inverse which is pro- 
portional to 1/y/a, assuming algorithm A makes no measurements. 
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This is a generalization of Grover's searching algorithm in which A 
was restricted to producing an equal superposition of all members 
of X and we had a promise that a single x existed such that xi x ) = 1- 
Our algorithm works whether or not the value of a is known ahead of 
time. In case the value of a is known, we can find a good x after a 
number of applications of A and its inverse which is proportional to 
1 / y/a even in the worst case. We show that this quadratic speedup can 
also be obtained for a large family of search problems for which good 
classical heuristics exist. Finally, as our main result, we combine ideas 
from Grover's and Shor's quantum algorithms to perform amplitude 
estimation, a process that allows to estimate the value of a. We ap- 
ply amplitude estimation to the problem of approximate counting, in 
which we wish to estimate the number of x S X such that x( x ) = 1- 
We obtain optimal quantum algorithms in a variety of settings. 

Keywords: Quantum computation. Searching. Counting. Lower bound. 



1 Introduction 

Quantum computing is a field at the junction of theoretical modern physics 
and theoretical computer science. Practical experiments involving a few 
quantum bits have been successfully performed, and much progress has been 
achieved in quantum information theory, quantum error correction and fault 
tolerant quantum computation. Although we are still far from having desk- 
top quantum computers in our offices, the quantum computational paradigm 
could soon be more than mere theoretical exercise. 



The discovery by Peter Shor |15j of a polynomial-time quantum algorithm 
for factoring and computing discrete logarithms was a major milestone in the 
history of quantum computing. Another significant result is Lov Grover's 
quantum search algorithm ||, Grover's algorithm does not solve NP-com- 
plete problems in polynomial time, but the wide range of its applications more 
than compensates for this. 

In this paper, we generalize Grover's algorithm in a variety of directions. 
Consider a problem that is characterized by a Boolean function x( x -> u) m 
the sense that y is a good solution to instance x if and only if x{ x iV) = 1- 
(There could be more than one good solution to a given instance.) If we have 
a probabilistic algorithm V that outputs a guess V(x) on input x, we can call 
V and x repeatedly until a solution to instance x is found. If x{ x i ^P{ x )) = 1 
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with probability p x > 0, we expect to repeat this process l/p x times on the 
average. Consider now the case when we have a quantum algorithm A instead 
of the probabilistic algorithm. Assume A makes no measurements: instead 
of a classical answer, it produces quantum superposition when run on 
input x. Let a x denote the probability that \^ x ), if measured, would be a 
good solution. If we repeat the process of running A on x, measuring the 
output, and using x t° check the validity of the result, we shall expect to 
repeat l/a x times on the average before a solution is found. This is no better 
than the classical probabilistic paradigm. 

In Section 0, we describe a more efficient approach to this problem, which 
we call amplitude amplification. Intuitively, the probabilistic paradigm in- 
creases the probability of success roughly by a constant on each iteration; by 
contrast, amplitude amplification increases the amplitude of success roughly 
by a constant on each iteration. Because amplitudes correspond to square 
roots of probabilities, it suffices to repeat the amplitude amplification pro- 
cess approximately times to achieve success with overwhelming prob- 
ability. For simplicity, we assume in the rest of this paper that there is 
a single instance for which we seek a good solution, which allows us to 
dispense with input x, but the generalization to the paradigm outlined 
above is straightforward. Grover's original database searching quantum al- 
gorithm is a special case of this process, in which x is given by a function 
/ : {0, 1, . . . , N — 1} — > {0, 1} for which we are promised that there exists a 
unique Xq such that f(xo) = 1. If we use the Fourier transform as quantum 
algorithm A — or more simply the Walsh-Hadamard transform in case N is 
a power of 2 — an equal superposition of all possible x's is produced, whose 
success probability would be 1/N if measured. Classical repetition would 
succeed after an expected number N of evaluations of /. Amplitude ampli- 
fication corresponds to Grover's algorithm: it succeeds after approximately 
\/N evaluations of the function. 

We generalize this result further to the case when the probability of suc- 
cess a of algorithm A is not known ahead of time: it remains sufficient to 
evaluate A and x an expected number of times that is proportional to 1/ \fa. 
Moreover, in the case a is known ahead of time, we give two different tech- 
niques that are guaranteed to find a good solution after a number of iterations 
that is proportional to 1/ y/a in the worst case. 

It can be proven that Grover's algorithm goes quadratically faster than 
any possible classical algorithm when function / is given as a black box. 
However, it is usually the case in practice that information is known about / 
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that allows us to solve the problem much more efficiently than by exhaustive 
search. The use of classical heuristics, in particular, will often yield a solution 
significantly more efficiently than straight quantum amplitude amplification 
would. In Section |3], we consider a broad class of classical heuristics and show 
how to apply amplitude amplification to obtain quadratic speedup compared 
to any such heuristic. 

Finally, Section f| addresses the question of estimating the success prob- 
ability a of quantum algorithm A. We call this process amplitude es- 
timation. As a special case of our main result (Theorem [T2| ), an esti- 
mate for a is obtained after any number M of iterations which is within 
2tt\/ a(l — a) /M + tt 2 /M 2 of the correct value with probability at least 8/tv 2 , 
where one iteration consists of running algorithm A once forwards and once 
backwards, and of computing function x once. As an application of this 
technique, we show how to approximately count the number of x such that 
f(x) = 1 given a function / : {0, 1, . . . , N — 1} — > {0, 1}. If the correct 
answer is t > 0, it suffices to compute the function yN times to obtain an 
estimate roughly within \/t of the correct answer. A number of evaluations 
of / proportional to \\/N/t yields a result that is likely to be within et of 
the correct answer. (We can do slightly better in case e is not fixed.) If it is 
known ahead of time that the correct answer is either t = or t = to for some 
fixed to, we can determine which is the case with certainty using a number 
of evaluations of / proportional to a/ N/t . If we have no prior knowledge 
about t, the exact count can be obtained with high probability after a num- 
ber of evaluations of / that is proportional to \/t(N — t) when < t < N 
and \fN otherwise. Most of these results are optimal. 

We assume in this paper that the reader is familiar with basic notions of 
quantum computing. 

2 Quantum amplitude amplification 

Suppose we have a classical randomized algorithm that succeeds with some 
probability p. If we repeat the algorithm, say, j times, then our probability 
of success increases to roughly jp (assuming jp <C 1). Intuitively, we can 
think of this strategy as each additional run of the given algorithm boosting 
the probability of success by an additive amount of roughly p. 

A quantum analogue of boosting the probability of success would be to 
boost the amplitude of being in a certain subspace of a Hilbert space. The 
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general concept of amplifying the amplitude of a subspace was discovered by 
Brassard and H0yer as a generalization of the boosting technique applied 
by Grover in his original quantum searching paper ||. Following Q and 0, 
we refer to their idea as amplitude amplification and detail the ingredients 
below. 

Let 7i denote the Hilbert space representing the state space of a quantum 
system. Every Boolean function x '■ ^ ~~ > {0, 1} induces a partition of 7i into 
a direct sum of two subspaces, a good subspace and a bad subspace. The good 
subspace is the subspace spanned by the set of basis states \x) G H for which 
x{x) = 1, and the bad subspace is its orthogonal complement in TL. We say 
that the elements of the good subspace are good, and that the elements of 
the bad subspace are bad. 

Every pure state |T) in 7i has a unique decomposition as |T) = |Ti) + 
|T ), where |Ti) denotes the projection onto the good subspace, and |T ) 
denotes the projection onto the bad subspace. Let ax = (Ti|Ti) denote 
the probability that measuring |T) produces a good state, and similarly, let 
b r = (T |T Q ). Since |Ti) and |T ) are orthogonal, we have + b T = 1. 

Let A be any quantum algorithm that acts on Ti, and uses no measure- 
ments. Let = A\0) denote the state obtained by applying A to the initial 
zero state. The amplification process is realized by repeatedly applying the 
following unitary operator [Q on the state \^f), 



Here, the operator S x conditionally changes the sign of the amplitudes of the 
good states, 



while the operator So changes the sign of the amplitude if and only if the 
state is the zero state |0). The operator Q is well-defined since we assume 
that A uses no measurements and, therefore, A has an inverse. 

The usefulness of operator Q stems from its simple action on the sub- 
space TCy spanned by the vectors and |^o)- 

Lemma 1 We have that 



Q = Q(-A,x) 



ASqA^S 



(1) 




Q|*i> = (l-2a)|*i) - 2a|* ) 
Q|*o> = 2(l-a)|* 1 ) + (l-2a)|* >, 
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where a = (^>i\^fi). 

It follows that the subspace TLqj is stable under the action of Q, a prop- 
erty that was first observed by Brassard and H0yer Q and rediscovered by 
Grover ]10] . 



Suppose < a < 1. Then is a subspace of dimension 2, and otherwise 
Tiq, has dimension 1. The action of Q on Tiq, is also realized by the operator 

U*U* , (2) 

which is composed of 2 reflections. The first operator, U# = I — y^l^o) (^o|) 
implements a reflection through the ray spanned by the vector |^o); while 
the second operator = I — 2| 1 I r )(\E r | implements a reflection through the 
ray spanned by the vector |\1>). 

Consider the orthogonal complement TL^ of TLq, in TC. Since the operator 
ASoA^ 1 acts as the identity on TC^, operator Q acts as — S x on TC%. Thus, Q 2 
acts as the identity on TC^, and every eigenvector of Q in Ti^ has eigenvalue 
+ 1 or — 1. It follows that to understand the action of Q on an arbitrary initial 
vector |T) in TC, it suffices to consider the action of Q on the projection of 
|T) onto TCy. 

Since operator Q is unitary, the subspace TCy has an orthonormal basis 
consisting of two eigenvectors of Q, 



(3) 



provided < a < 1 , where i = denotes the principal square root of — 1 . 
The corresponding eigenvalues are 

A± = e ±i2< \ (4) 

where the angle 6 a is defined so that 

sin 2 (# a ) = a = (#i|#i> (5) 

and < 6 a < 7r/2. 

We use operator Q to boost the success probability a of the quantum 
algorithm A. First, express |^) = A\0) in the eigenvector basis, 

A\0) = |*) = ^ (e*»|tf+) - e-** B |*_)) . (6) 
v2 
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It is now immediate that after j applications of operator Q, the state is 




cos((2j + l)0 a )|tf o ). (8) 



(7) 



It follows that if < a < 1 and if we compute Q m |\l/) for some integer m > 0, 
then a final measurement will produce a good state with probability equal 
to sin 2 ((2m+ 1)0 O ). 

If the initial success probability a is either or 1, then the subspace 
spanned by and |\&o) has dimension 1 only, but the conclusion 

remains the same: If we measure the system after m rounds of amplitude 
amplification, then the outcome is good with probability sin 2 ((2m + l)9 a ), 
where the angle 6 a is defined so that Equation |5| is satisfied and so that 



Therefore, assuming a > 0, to obtain a high probability of success, we 
want to choose integer m such that sin 2 ((2m + 1)6 a) is close to 1. Unfortu- 
nately, our ability to choose m wisely depends on our knowledge about 6 a , 
which itself depends on a. The two extreme cases are when we know the 
exact value of a, and when we have no prior knowledge about a whatsoever. 

Suppose the value of a is known. If a > 0, then by letting m = |_7r/40 o J, 
we have that sin 2 ((2m + 1)6 a ) > 1 — a, as shown in M. The next theorem is 
immediate. 

Theorem 2 (Quadratic speedup) Let A be any quantum algorithm that 
uses no measurements, and let x '■ 22 — > {0, 1} be any Boolean function. 
Let a the initial success probability of A. Suppose a > 0, and set m = 
\n/A6 a \, where 6 a is defined so that sin 2 (6' a ) = a and < 6 a < ir/2. Then, 
if we compute Q"Vl|0) and measure the system, the outcome is good with 
probability at least max(l — a, a). 

Note that any implementation of algorithm Q m ^4|0) requires that the 
value of a is known so that the value of m can be computed. We refer to 
Theorem || as a quadratic speedup, or the square-root running-time result. 
The reason for this is that if an algorithm A has success probability a > 0, 
then after an expected number of If a applications of A, we will find a good 
solution. Applying the above theorem reduces this to an expected number 
of at most (2m + l)/max(l — a, a) G Q(-j=) applications of A and A^ 1 . 



0<6 a < tt/2. 
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As an application of Theorem consider the search problem || in which 
we are given a Boolean function / : {0,1,... ,N—1} — > {0,1} satisfying the 
promise that there exists a unique xq G {0, 1, . . . , N — 1} on which / takes 
value 1, and we are asked to find xq. If / is given as a black box, then on a 
classical computer, we need to evaluate / on an expected number of roughly 
half the elements of the domain in order to determine Xq. 

By contrast, Grover || discovered a quantum algorithm that only requires 
an expected number of evaluations of / in the order of y/N. In terms of 
amplitude amplification, Grover's algorithm reads as follows: Let x = /> an d 
let A = W be the Walsh-Hadamard transform on n qubits that maps the 
initial zero state |0) to -7= J2x=o l x )> an equally-weighted superposition of all 
N = 2 n elements in the domain of /. Then the operator Q = — ^4So^4 _1 S x is 
equal to the iterate — WSo WS f applied by Grover in his searching paper . 
The initial success probability a of A is exactly l/N, and if we measure 
after m = |_7r/46' £X J iterations of Q, the probability of measuring x is lower 
bounded by I -l/N §. 

Now, suppose that the value of a is not known. In Section [|, we discuss 
techniques for finding an estimate of a, whereafter one then can apply a 
weakened version of Theorem |2| in which the exact value of a is replaced by 
an estimate of it. Another idea is to try to find a good solution without prior 
computation of an estimate of a. Within that approach, by adapting the 
ideas in Section 6 in [[| we can still obtain a quadratic speedup. 

Theorem 3 (Quadratic speedup without knowing a) There exists a 
quantum algorithm QSearch with the following property. Let A be any 
quantum algorithm that uses no measurements, and let \ : Z — >• {0, 1} be any 
Boolean junction. Let a denote the initial success probability of A. Algorithm 
QSearch finds a good solution using an expected number of applications of 
A and A^ 1 which are in ©(-75) if a > 0, and otherwise runs forever. 

The algorithm in the above theorem utilizes the given quantum algo- 
rithm A as a subroutine and the operator Q. The complete algorithm is as 
follows: 

Algorithm( QSearch(^4, x) ) 

1. Set / = and let c be any constant such that 1 < c < 2. 

2. Increase I by 1 and set M = \c l ~\ . 
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3. Apply A on the initial state |0), and measure the system. If the out- 
come \z) is good, that is, if x( z ) — 1> then output z and stop. 

4. Initialize a register of appropriate size to the state ^4|0). 

5. Pick an integer j between 1 and M uniformly at random. 

6. Apply Q J to the register, where Q = Q(A,x)- 

7. Measure the register. If the outcome \z) is good, then output z and 
stop. Otherwise, go to step ||. 

The intuition behind this algorithm is as follows. In a 2-dimensional real 
vector space, if we pick a unit vector (x,y) = (cos(-), sin(-)) uniformly at 
random then the expected value of y 2 is 1/2. Consider Equation || If we 
pick j at random between 1 and M for some integer M such that M9 a is 
larger than, say, 1007T, then we have a good approximation to a random unit 
vector, and we will succeed with probability close to 1/2. 

To turn this intuition into an algorithm, the only obstacle left is that we 
do not know the value of 8 a , and hence do not know an appropriate value 
for M. However, we can overcome this by using exponentially increasing 
values of M, an idea similar to the one used in "exponential searching" 
(which is a term that does not refer to the running time of the method, but 
rather to an exponentially increasing growth of the size of the search space). 

The correctness of algorithm QSearch is immediate and thus to prove 
the theorem, it suffices to show that the expected number of applications 
of A and A -1 is in the order of 1/y/a. This can be proven by essentially the 
same techniques applied in the proof of Theorem 3 in 0] and we therefore 
only give a very brief sketch of the proof. 

On the one hand, if the initial success probability a is at least 3/4, then 
step [| ensures that we soon will measure a good solution. On the other hand, 
if0<a<3/4 then, for any given value of M, the probability of measuring 
a good solution in step [7| is lower bounded by 



Let c > be such that c = 2(1 — c ) and let M = 1/ (2c 0y /a). The 
expected number of applications of A is upper bounded by T\ + T 2 , where 
T\ denotes the maximum number of applications of A the algorithm uses 




(9) 
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while M < Mo, and where T 2 denotes the expected number of applications 
of A the algorithm uses while M > M . Clearly T\ G O(M ) = O(^) and 
we now show that T 2 G 0(4^) as well. 

For all M > M , the measurement in step |7| yields a good solution with 
probability at least ~(1 — c ), and hence it fails to yield a good solution with 
probability at most p — ^(1 + cq). Thus for all z > 0, with probability at 
most Pq; we have that M > Mqc % at some point after step |2| while running 
the algorithm. Hence T 2 is at most on the order of Y2i>o ^o(cpo) 4 which is 
in O(M ) since cpo < 1. The total expected number of applications of A is 
thus in O(Mq), which is 0{-j=). 

For the lower bound, if M were in o(-^), then the probability that we 
measure a good solution in step ^ would be vanishingly small. This completes 
our sketch of the proof of Theorem [3|. 



2.1 Quantum de-randomization when the success 
probability is known 

We now consider the situation where the success probability a of the quantum 
algorithm A is known. If a = or a = 1, then amplitude amplification will 
not change the success probability, so in the rest of this section, we assume 
that < a < 1. Theorem || allows us to boost the probability of success to 
at least max(l — a, a). A natural question to ask is whether it is possible 
to improve this to certainty, still given the value of a. It turns out that the 
answer is positive. This is unlike classical computers, where no such general 
de-randomization technique is known. We now describe 2 optimal methods 
for obtaining this, but other approaches are possible. 

The first method is by applying amplitude amplification, not on the orig- 
inal algorithm A, but on a slightly modified version of it. By Equation || 
if we measure the state Q m .A|0), then the outcome is good with probabil- 
ity sin 2 ((2m + 1)6 a ). In particular, if m = n/A6 a — 1/2 happens to be an 
integer, then we would succeed with certainty after rh applications of Q. 
In general, m = \m\ iterations is a fraction of 1 iteration too many, but 
we can compensate for that by choosing 6 a = 7r/(4m + 2), an angle slightly 
smaller than 6 a . Any quantum algorithm that succeeds with probability a 
such that sin 2 (# a ) = a, will succeed with certainty after m iterations of am- 
plitude amplification. Given A and its initial success probability a, it is easy 
to construct a new quantum algorithm that succeeds with probability a < a: 
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Let B denote the quantum algorithm that takes a single qubit in the initial 
state |0) and rotates it to the superposition yl — a/a |0) + yja/a Apply 
both ^4 and £>, and define a good solution as one in which A produces a good 
solution, and the outcome of B is the state |1). Theorem [| follows. 

Theorem 4 (Quadratic speedup with known a) Let A be any quan- 
tum algorithm that uses no measurements, and let \ : Z — > {0, 1} be any 
Boolean function. There exists a quantum algorithm that given the initial 
success probability a > of A, finds a good solution with certainty using a 
number of applications of A and A^ 1 which is in Q{-^=) in the worst case. 

The second method to obtain success probability 1 requires a generaliza- 
tion of operator Q. Given angles < 0, tp < 2tt, redefine Q as follows, 

Q = Q(A,xA,<p) = -ASoi^A-'S^). (10) 

Here, the operator S x (<£>) is the natural generalization of the S x operator, 




e l *\x) ifxO) = l 
\x) if x( x ) — 0. 



Similarly, the operator So(0) multiplies the amplitude by a factor of e 1 ^ if and 
only if the state is the zero state |0). The action of operator Q(y4, %■> 0j V 9 ) 
is also realized by applying an operator that is composed of two pseudo- 
reflections: the operator AS (<f)) A^ 1 and the operator — S x (<p). 

The next lemma shows that the subspace spanned by and \^ ) is 
stable under the action of Q, just as in the special case Q(^4, x-> 7r ) studied 
above. 

Lemma 5 Let Q = Q(^4, Xi L P)- Then 

Ql^) = e ^((l - e**)a - l)|^i) + e^(l - e^)a|* ) 
Q|^o) = (1 - e^)(l - a)|*!> - ((1 - e l4 >)a + e^)|* ), 

where a = . 

Let rh = ir/4:6 a — 1/2, and suppose that m is not an integer. In the 
second method to obtain a good solution with certainty, we also apply \m\ 
iterations of amplitude amplification, but now we slow down the speed of the 
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very last iteration only, as opposed to of all iterations as in the first method. 
For the case fa < 1, this second method has also been suggested by Chi and 
Kim ||. We start by applying the operator Q(A, Xi 4>i V 9 ) with <p = ip = n 
a number of \fh\ times to the initial state = A\0). By Equation [8|, this 
produces the superposition 

-^sin((2LmJ + l)6 a ) |^) + -=L= cos {{2[m\ + 1)6 a ) |* ). 
V Q v 1 — a 



Then, we apply operator Q one more time, but now using angles <fi and (p, 
both between and 2n, satisfying 



e^)v^sin((2LmJ +1)6*) 



= ((1 - e*)a + e^)-==cos ((2[m\ + l)6 a ) . (11) 
V 1 — a 

By Lemma |5], this ensures that the resulting superposition has inner product 
zero with \^o), and thus a subsequent measurement will yield a good solution 
with certainty. 

The problem of choosing 0, (p e R such that Equation |TT] holds is equiv- 
alent to requiring that 

cot ((2[mJ + 1)0«) = e^sin(20 o )(- cos(2fl a ) + i cot(0/2)) _1 . (12) 

By appropriate choices of and (p, the right hand side of Equation [T2| can be 
made equal to any nonzero complex number of norm at most tan(20 a ). Thus, 
since the left hand side of this equation is equal to some real number smaller 



than tan(2# a ), there exist <j>, (p £ R such that Equation ^ is satisfied, and 
hence also such that the expression in Equation [II] vanishes. In conclusion, 
applying Q(A, x, (ft, V 9 ) with such 0, tp e R at the very last iteration allows us 
to measure a good solution with certainty. 



3 Heuristics 

As explained in the previous section, using the amplitude amplification tech- 
nique to search for a solution to a search problem, one obtains a quadratic 
speedup compared to a brute force search. For many problems, however, 
good heuristics are known for which the expected running time, when ap- 
plied to a "real-life" problem, is in o(VN), where N is the size of the search 



12 



space. This fact would make amplitude amplification much less useful un- 
less a quantum computer is somehow able to take advantage of these classical 
heuristics. In this section we concentrate on a large family of classical heuris- 
tics that can be applied to search problems. We show how these heuristics 
can be incorporated into the general amplitude amplification process. 

By a heuristic, we mean a probabilistic algorithm, running in polyno- 
mial time, that outputs what one is searching for with some non-negligible 
probability. 

Suppose we have a family T of functions such that each / G T is of the 
form / : X — > {0, 1}. For a given function / we seek an input iGl such that 
f(x) = 1. A heuristic is a function G : T x R — > X, for an appropriate finite 
set R. The heuristic G uses a random seed r G R to generate a guess for an x 
such that f(x) = 1. For every function / G let tf = \{x G X \ f(x) = 1}|, 
the number of good inputs x, and let hf = \{r G R | f(G(f,r)) = 1}|, the 
number of good seeds. We say that the heuristic is efficient for a given / if 
> that is, if using G and a random seed to generate inputs 

to / succeeds with a higher probability than directly guessing inputs to / 
uniformly at random. The heuristic is good in general if 




Here Ejc denotes the expectation over all / according to some fixed distri- 
bution. Note that for some /, hf might be small but repeated uses of the 
heuristic, with seeds uniformly chosen in R, will increase the probability of 
finding a solution. 

Theorem 6 Let JF C {/ | / : X — > {0, 1}} be a family of Boolean functions 
and V be a probability distribution over T . If on a classical computer, using 
heuristic G : J-'xR — > X , one finds x G X such that f(xo) = 1 for random f 
taken from distribution D in expected time T then using a quantum computer, 
a solution can be found in expected time in 0(y/T). 

Proof A simple solution to this problem is to embed the classical heuristic 
G into the function used in the algorithm QSearch. Let x{ r ) = f{G{f,r)) 
and x = G(f, QSearch(W, x)), so that f(x) = 1. By Theorem |3], for each 
function / G J 7 , we have an expected running time in Q(y/\R\/hf ). Let Pf 
denote the probability that / occurs. Then ^2,t e:F Pf = 1, and we have that 
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the expected running time is in the order of Ylif^r VlWT^f Pfi "which can 
be rewritten as 



\R\ 



1/2 f N 1/2 



T,T7 p t 



1/2 



by Cauchy-Schwarz's inequality. 



□ 



An alternative way to prove Theorem |6] is to incorporate the heuristic 
into the operator A and do a minor modification to /. Let A be the quan- 
tum implementation of G. It is required that the operator A be unitary, 
but clearly in general the classical heuristic does not need to be reversible. 
As usual in quantum algorithms one will need first to modify the heuris- 
tic G : T x R — > X to make it reversible, which can be done efficiently using 
standard techniques . We obtain a reversible function G'^ : R x — ► R x X. 
Let A be the natural unitary operation implementing G'f and let us modify 
X (the good set membership function) to consider only the second part of 
the register, that is x(( r ? x )) = 1 if and only if f(x) = 1. We then have that 
a = hf/\R\ and by Th eorem ^ , for each function / G we have an expected 
running time in ®(yJ\R\/hf ). The rest of the reasoning is similar. This 
alternative technique shows, using a simple example, the usefulness of the 
general scheme of amplitude amplification described in the preceding section, 
although it is clear that from a computational point of view this is strictly 
equivalent to the technique given in the earlier proof of the theorem. 



4 Quantum amplitude estimation 

Section [| dealt in a very general way with combinatorial search problems, 
namely, given a Boolean function / : X {0, 1} find an x G X such that 
f(x) = 1. In this section, we deal with the related problem of estimating 
t = \ {x G X | f(x) = 1}|, the number of inputs on which / takes the value 1. 

We can describe this counting problem in terms of amplitude estimation. 
Using the notation of Section |^, given a unitary transformation A and a 
Boolean function x, let |\&) = A\0). Write |^) = + |\&o) as a superposi- 
tion of the good and bad components of |\&). Then amplitude estimation is 
the problem of estimating a = (^iI^i), the probability that a measurement 
of |^) yields a good state. 
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The problem of estimating t — \{x G X | f(x) = 1}| can be formulated 
in these terms as follows. For simplicity, we take X = {0, 1, . . . , N — 1}. If 
iV is a power of 2, then we set \ = f and A = W. If N is not a power of 2, 
we set X = f an d A = Fn, the quantum Fourier transform which, for every 
integer M > 1, is defined by 

1 M-l 

F M : |x> i— > ^ e 2m ^ /M |?/> (0<x<M). (13) 

Then in both cases we have a = t/N, and thus an estimate for a directly 
translates into an estimate for t. 

To estimate a, we make good use of the properties of operator Q = 
— ^4So^4 _1 Sf. By Equation || in Section |[ we have that the amplitudes of 
and l^o) as functions of the number of applications of Q, are sinusoidal 
functions, both of period j-. Recall that < 9 a < n/2 and a = sin 2 (# a ), and 
thus an estimate for 9 a also gives an estimate for a. 

To estimate this period, it is a natural approach to apply Fourier 
analysis like Shor [ITH] does for a classical function in his factoring algorithm. 



This approach can also be viewed as an eigenvalue estimation [12], 0] and is 
best analysed in the basis of eigenvectors of the operator at hand [0. By 
Equation[|, the eigenvalues of Q on the subspace spanned by and |\l/o) 
are A + = e l29a and A_ = e~ l2da . Thus we can estimate a simply by estimating 
one of these two eigenvalues. Errors in our estimate 8 a for 8 a translate into 
errors in our estimate a = sin 2 (# a ) for a, as described in the next lemma. 

Lemma 7 Let a = sm 2 (9 a ) and a = sin 2 (# a ) with < 9 a , 9 a < 2n then 

\9 a -9 a \<e =^ |a - a\ < 2ey/a(l - a) + e 2 . 

Proof For e > 0, using standard trigonometric identities, we obtain 

sm 2 (9 a + e) — sin 2 (6> a ) = a/ a(l — a) sin(2£) + (1 — 2a) sin 2 (e) and 
sm 2 {9 a ) -sin 2 (9 a -e) = y/a{l - a) sm(2e) + {2a - 1) sin 2 (e). 

The inequality follows directly. □ 

We want to estimate one of the eigenvalues of Q. For this purpose, we 
utilize the following operator A. For any positive integer M and any unitary 
operator U, the operator A M (U) is defined by 

\j)\y) ^ \j)(U j \y)) (0<j<M). (14) 
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Note that if |$) is an eigenvector of U with eigenvalue e 2 ™, then A M (XJ) 
maps \j)\$) to e 2mujj \j)\$). 

Definition 8 For any integer M > and real number < uj < 1, let 



M-1 



\Sm(uj)) 



-y 



\y)- 



We then have, for all < x < M — 1 

F M \x) = \S M {x/M)). 

The state \Sm{w)) encodes the angle 2nu (0 < uj < 1) in the phases of 
an equally weighted superposition of all basis states. Different angles have 
different encodings, and the overlap between |<Sm(<^o)) an d \Sm{^i)) is a 
measure for the distance between the two angles ujq and oj\. 

Definition 9 For any two real numbers uj ,uji G K, let d(uo,uJi) = 
mm zeZ {\z + uj x - u \}. 

Thus 2nd(u , u>i) is the length of the shortest arc on the unit circle going 
from e 2muJ ° to e 2 ™ 1 . 

Lemma 10 For < uoq < 1 and < uo\ < 1 let A = d(uj ,uji). If A = we 
/lave \{Sm(uo)\Sm{ui))\ 2 = 1. Otherwise 



\(SmM\SmM)\ 



2 _ sin 2 (MA7r) 
M 2 sin 2 (A7r) 



Proof 



\{SmM\SmM)\' 



M-1 



j/=0 



M-1 



-2iriuJoy I 



j/=0 



i 

M 2 



M-1 
2/=0 



sin 2 (MA7r) 
M 2 sin 2 (A7r)' 



□ 
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Consider the problem of estimating uj where < u> < 1, given the state 
\S M {w))- If w = x/M for some integer < x < M, then F^\S M (x/M)} = 
\x) by definition, and thus we have a perfect phase estimator. If Muj is not 
an integer, then observing \Sm{w)) still provides a good estimation of u, 
as shown in the following theorem. 



Theorem 11 Let X be the discrete random variable corresponding to the 
classical result of measuring Fjj\S M (u)) in the computational basis. If Muj 
is an integer then Prob(X = Muj) = 1. Otherwise, letting A = d(uj,x/M), 

„ , /v , sin 2 (MA7r) 1 
Prob(X = x) = a-f9 . 2 \ < 



M 2 sin 2 (A7r) ~ (2MA) i 
For any k > 1 we also have 

1 



Prob (d(X/M, uj) < k/M) > 1 



2(fc- 1) 

and, zn the case k = 1 and M > 2, 



Proof Clearly 



Prob (d(X/M, uj) < l/M) > — . 



Prob(X = x) = |(a;|F- 1 |«S M (a;)}| 2 

|2 



|(F|x)) t |5 A/ H)| 
K5 w (z/M)|5 M (w))| : 



thus using Lemma 10 we directly obtain the first part of the theorem. We 



use this fact to prove the next part of the theorem. 



Prob (d(X/M, uj) < k/M) = 1 - Prob(d(X/M, uj) > k/M) 



1-2V 

^ A A/121 



> 

j=k """" VM 
1 

" 1 ~ 2(k-l) 
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For the last part, we use the fact that for M > 2, the given expression 
attains its minimum at A = 1/(2M) in the range < A < 1/M. 

Prob (d(X/M, u) < 1 /M) = Prob(X = [Muo\ ) + Prob(X = \MuS\ ) 

sin 2 (MAvr) sin 2 (M(^ - A)tt) 
M 2 sin 2 (A7r) + M 2 sin 2 ((-^ - A)tt) 
8 

> 



7T 2 



□ 



The following algorithm computes an estimate for a, via an estimate 
for# a . 



Algorithm( Est_Amp(^l, x, M) ) 

1. Initialize two registers of appropriate sizes to the state |0)^4|0). 

2. Apply Fm to the first register. 

3. Apply Am(Q) where Q = — ^ISo S x . 

4. Apply FjJ to the first register. 

5. Measure the first register and denote the outcome \y). 

6. Output a = sin 2 (7r-^). 

Steps 1 to H are illustrated on Figure |l|. This algorithm can also be 
summarized, following the approach in ||11||, as the unitary transformation 



(c^m ® i) Am(q) (f m ®i; 



applied on state |0)^4|0), followed by a measurement of the first register and 
classical post-processing of the outcome. In practice, we could choose M to 
be a power of 2, which would allow us to use a Walsh-Hadamard transform 
instead of a Fourier transform in step 0. 
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Figure 1: Quantum circuit for amplitude estimation. 



Theorem 12 (Amplitude Estimation) For any positive integer k, the al- 
gorithm Est_Amp(^4, x, M) outputs a (0 < a < 1) such that 



\a — a\ < 2nk 



7T 



M 



M 2 



with probability at least -4j when k = 1 and m& probability greater than 
1 — 2(fc~[) ^ or ^ — 2- -ft wses exactly M evaluations of f . If a = t/ien a = 
u^/i certainty, and if a = 1 and M zs even, taen a = 1 tw£/i certainty. 



Proof After step [I], by Equation |6], we have state 

|0>^|0> = ^|0) (e"-|¥ + ) - e-^|*_)) 
After step |2|, ignoring global phase, we have 

1 M-l 



3=0 
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and after applying A M (Q) we have 



1 M-1 

s= V \j) (e l0a e 2ij6a \y + ) - e^e -2 ^'!*-)) 
s/2M 4^ V ; 




^|<S M (^))|* + ) - ^-|<Sm(1-^))|*-)- 

We then apply F^/ to the first register and measure it in the computational 
basis. 

The rest of the proof follows from Theorem 11. Tracing out the sec- 
ond register in the eigenvector basis, we see that the first register is in an 
equally weighted mixture of F^\S M {^)) and F~^\S M {t — ^f))- Thus the 
measured value \y) is the result of measuring either the state F]^\Sm( )) or 
the state F^ l |iSm(1 — The probability of measuring \y) given the state 
F^- |«Sjvf (1 — 2"-)) is equal to the probability of measuring \M — y) given the 

state F^J\Sm(^))- Since sin 2 f^ -^f ) = s i n2 ( 7r M')' we can assume we 
measured \y) given the state F^ |<Sm( )) and 9 a = 7r-g estimates 9 a as de- 



scribed in Theorem II. Thus we obtain bounds on d(9 a , 9 a ) that translate, 



using Lemma |7], into the appropriate bounds on \a — a\. □ 

A straightforward application of this algorithm is to approximately count 
the number of solutions t to f(x) = 1. To do this we simply set A = W if 
A" is a power of 2, or in general A = F^ or any other transformation that 
maps |0) to -^^2f=Q Setting x = /, we then have a = (^iI^i) = t/N, 
which suggests the following algorithm. 

Algorithm( Count(/,M) ) 

1. Output t' = N x Est_Amp(Fjv,/,M). 



By Theorem O, we obtain the following. 
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Theorem 13 (Counting) For any positive integers M and k, and any 
Boolean function f : {0, 1, . . . , iV — 1} — > {0, 1}, the algorithm Count(/, M) 
outputs an estimate t! to t = |/ _1 (1)| such that 

i,i , y/t(N - 1) 9l9 N 

\t'-t\ < 2nk-^ J - + ir 2 k 2 — 

1 1 - M M 2 

with probability at least 8/tt 2 when k = 1, and with probability greater than 
1 — 2 (fc_i) f or k>2. Ift = then t' = with certainty, and ift = N and M 
is even, then t' = N with certainty. 

Note that Count(/, M) outputs a real number. In the following count- 
ing algorithms we will wish to output an integer, and therefore we will 
round off the output of Count to an integer. To assure that the round- 
ing off can be done efficiently^ we will round off to an integer t satisfying 
|f-Count(/,M)| < §. 

If we want to estimate t within a few standard deviations, we can apply 
algorithm Count with M = \y/N ] . 

Corollary 14 Given a Boolean function f : {0, 1, . . . , iV — 1} — >• {0, 1} with 
t defined as above, rounding off the output of Count (/, \y/N ] ) gives an 
estimate i such that 



\t-t\ < 2nfV^ + ll (15) 

with probability at least 8/tt 2 and requires exactly \V~N ] evaluations of f . 

We now look at the case of estimating t with some relative error, also re- 
ferred to as approximately counting t with accuracy e. For this we require the 
following crucial observation about the output t' of algorithm Count (/,L). 
Namely t' is likely to be equal to zero if and only if L G o(y/N/t). Thus, we 
can find a rough estimate of y/N/t simply by running algorithm Count (/, L) 
with exponentially increasing values of L until we obtain a non-zero output. 
Having this rough estimate L of y/N/t we can then apply Theorem [13] with 
M in the order of \L to find an estimate t of t with the required accuracy. 
The precise algorithm is as follows. 



-'^For example, if t' + i is super-exponentially close to an integer n we may not be able 
to decide efficiently if t' is closer to n or n — 1. 
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Algorithm( Basic_Approx_Count(/, s) ) 

1. Start with i = 0. 

2. Increase £ by 1. 

3. Set t' = Count(/,2*). 

4. If t' = and 2^ < 2^/N then go to step |. 

5. SetM= [^2*]. 

6. Set t' = Count(/,M). 

7. Output an integer t satisfying f — < |. 

Theorem 15 Given a Boolean function f with N and t defined as above, 
and any < e < 1, Basic_Approx_Count(/, e) outputs an estimate t such 
that 

\i-t\ < et 

with probability at least |, using an expected number of evaluations of f which 
is in Q(j\/ N/t) . Ift — 0, the algorithm outputs t = t with certainty and f 
is evaluated a number of times in 9 [vN) ■ 

Proof When t = 0, the analysis is straightforward. For t > 0, let 9 denote 
6 t / N and m = [log 2 (^)J. From Theorem [TT] we have that the probability 
that step |3] outputs Count (/, 2 e ) = for £ = 1, 2, . . . , m is 

The previous inequalities are obtained by using the fact that sin(M#) > 
Msin(#) cos(M6>) for any M > and < M9 < |, which can be readily 
seen by considering the Taylor expansion of tan(x) at x = M9. 

Now assuming step 131 has outputted at least m times (note that 
2 m < ^ < \^Wt < 2VN), after step | we have M > ^2 m+1 > an d 
by Theorem [13] (and the fact that 9 < |sin(6 l ) = ^^t/N) the probability 
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2 

that Count (/,M) outputs an integer t satisfying \t — t\ < 1 1 + |jt is at 
least 8/n 2 . Let us suppose this is the case. If et < 1, then \t — 1\ < 1 and, 
since t and t are both integers, we must have t = t. If et > 1, then rounding 
off t! to t introduces an error of at most | < yt, making the total error at 

most § t + ||t + y£ < et. Therefore the overall probability of outputting an 
estimate with error at most et is at least cos 2 (|) x (8/n 2 ) > 2 



3' 



To upper bound the number of applications of /, note that by Theorem 13, 



for any integer L > l&ityjN/t, the probability that Count (/, L) outputs is 
less than 1/4. Thus the expected value of M at step | is in 0(§\A/V/t). □ 

We remark that in algorithm Basic_Approx_Count, we could alterna- 
tively to steps 1 to H use algorithm QSearch of Section ^ provided we have 
QSearch also output its final value of M. In this case, we would use (a mul- 
tiple of) that value as our rough estimate of y/N/t, instead of using the final 
value of 2 e found in step |] of Basic_Approx_Count. 

Algorithm Basic_Approx_Count is optimal for any fixed e, but not in 
general. In Appendix |X| we give an optimal algorithm, while we now present 
two simple optimal algorithms for counting the number of solutions exactly. 
That is, we now consider the problem of determining the exact value of 
t = 1)|. In the special case that we are given a nonzero integer i and 

promised that either t = or t = to, then we can determine which is the case 
with certainty using a number of evaluations of / in 0(yj 'N /t ). This is an 
easy corollary of Theorem [| and we state it without proof. 

Theorem 16 Let f : {0, 1, . . . , iV— 1} — > {0, 1} be a given Boolean function 
such that the cardinality of the preimage of 1 is either or to- Then there 
exists a quantum algorithm that determines with certainty which is the case 
using a number of evaluations of f which is in Q^N/t ^j , and in the latter 
case, also outputs a random element o//~ 1 (l). 

For the general case in which we do not have any prior knowledge about t, 
we offer the following algorithm. 



Algorithm( Exact_Count(/) ) 

1. Set t[ = Count (/, \UttVn]) and t' 2 = Count (/, \UttVn]). 

2. Let M { = 130^ + 1X^-^ + 1)1 for i = 1,2. 
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3. Set M = mm{M 1 , M 2 }. 

4. Set t' = Count (f,M). 

5. Output an integer t satisfying \t — t'\ < |. 



The main idea of this algorithm is the same as that of algorithm 
Basic_Approx_Count. First we find a rough estimate t' r of t, and then 
we run algorithm Count(/, M) with a value of M that depends on t' r . 
By Theorem if we set M to be in the order of y/t' r (N — t' r ), then the 
output t' = Count (/,M) is likely to be so that \t' — t\ < |, in which case 
t = t. 

Theorem 17 Given a Boolean function f with N and t defined as above, 
algorithm Exact _Count requires an expected number of evaluations of f 
which is in 0(\/ (t + 1)(N — t + 1) ) and outputs an estimate t which equals 
t with probability at least | using space only linear in log(iV). 



Proof Apply Theorem 13 with k = 7. For each i — 1,2, with probability 



greater than outcome t! i satisfies \t' { — 1\ < \J t<yN N - + 1/4, in which case 
we also have that \/t(N — t) < -^Mj,. Thus, with probability greater than 
(li) 2 ' we nave 



VKN - 1) < V2 

M ~ 30 ' 



Suppose this is the case. Then by Theorem [13], with probability at least 8/tt , 



2rrV2 4vr 2 1 
t ' -t < — — + — < - 
1 1 ~ 30 30 2 3 

and consequently 

\t-t\ < 1. 

Hence, with probability at least (y^) 2 X 8/tt 2 > |, we have i = t. 

The number of applications of / is 2 [M^x/iV ] + M. Consider the ex- 
pected value of Mi for i — 1, 2. Since 

v / (?+5R+i) < V(t + i)(N-t + i) + VN\t-t\ 
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for any < t' { ,t < N, we just need to upper bound the expected value 
of y/N\t^t\. By Theorem |T|, for any k > 2, 



with probability at least 1 — r- Hence Mi is less than 

30(1 + k) (^(t + 1)(N - t + 1) + VN^ + 1 (16) 

with probability at least 1 — r- 

In particular, the minimum of Mi and M2 is greater than the expression 
given in Equation [16] with probability at most X. Since any positive random 
variable Z satisfying Prob(Z > k) < X has expectation upper bounded by 

a constant, the expected value of M is in 0(y/(t + l)(N -t + 1)). □ 

It follows from Theorem 4.10 of |TJ that any quantum algorithm 
capable of deciding with high probability whether or not a func- 
tion / : {0,1,... ,JV- 1} -»• {0, 1} is such that |/ -1 (l)|<t, given some 
< t < N, must query / a number of times which is at least in 
n( v /(t + l)(N-t + 1)) times. Therefore, our exact counting algorithm is 
optimal up to a constant factor. 

Note also that successive applications of Grover's algorithm in which we 
strike out the solutions as they are found will also provide an algorithm 
to perform exact counting. In order to obtain a constant probability of 
success, if the algorithm fails to return a new element, one must do more 
than a constant number of trials. In particular, repeating until we get log(iV) 
failures will provide an overall constant probability of success. Unfortunately, 



the number of applications of / is then in 0(VtN + \og(N)^/N/i) and the 
cost in terms of additional quantum memory is prohibitive, that is in O(i). 



5 Concluding remarks 

Let / : {0, 1, . . . , N — 1} — ► {0, 1} be a function provided as a black box, 
in the sense that the only knowledge available about / is given by evaluat- 
ing it on arbitrary points in its domain. We are interested in the number 
of times that / must be evaluated to achieve certain goals, and this num- 
ber is our measure of efficiency Grover's algorithm can find the Xq such 
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that f(xo) = 1 quadratically faster in the expected sense than the best pos- 
sible classical algorithm provided the solution is known to be unique || ||. 
We have generalized Grover's algorithm in several directions. 



o The quadratic speedup remains when the solution is not unique, even 
if the number of solutions is not known ahead of time. 

o If the number of solutions is known (and nonzero), we can find one 
quadratically faster in the worst case than would be possible classically 
even in the expected case. 

o If the number t of solutions is known to be either or t , we can tell 
which is the case with certainty, and exhibit a solution if t > 0, in a 
time in O(^/N/t ) in the worst case. By contrast, the best classical 
algorithm would need N — 1 + 1 queries in the worst case. This is 
much better than a quadratic speedup when t is large. 

o The quadratic speedup remains in a variety of settings that are not con- 
strained to the black-box model: even if additional information about 
/ can be used to design efficient classical heuristics, we can still find 
solutions quadratically faster on a quantum computer, provided the 
heuristic falls under the broad scope of our technique. 

o We give efficient quantum algorithms to estimate the number of 
solutions in a variety of error models. In all cases, our quantum algo- 
rithms are proven optimal, up to a multiplicative constant, among 
all possible quantum algorithms. In most cases, our quantum algo- 
rithms are known to be quadratically faster than the best possible 
classical algorithm. In the case of counting the number of solutions 
up to relative error e, our optimal quantum algorithm is quadrati- 
cally faster than the best known classical algorithm for fixed e, but 
in fact it is better than that when e is not a constant. Since we do 
not believe that a super-quadratic quantum improvement for a non- 
promise black-box problem is possible, we conjecture that there exists 
a classical algorithm that uses a number of queries in 0(min{M 2 , N}), 

where M = + ^{^+1 is proportional to the number of queries 

required by our optimal quantum algorithm. This conjecture is further 
supported by the fact that we can easily find a good estimate for M 2 , 
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without prior knowledge of t, using a number of classical queries in 

o We can amplify efficiently the success probability not only of classical 
search algorithms, but also of quantum algorithms. More precisely, if a 
quantum algorithm can output an x that has probability a > of being 
such that f(x) = 1, then a solution can be found after evaluating / an 
expected number of time in 0(1/ y/a). If the value of a is known, a 
solution can be found after evaluating / a number of time in 0(1/ y/a) 
even in the worst case. We call this process amplitude amplification. 
Again, this is quadratically faster than would be possible if the quantum 
search algorithm were available as a black box to a classical algorithm. 

o Finally, we provide a general technique, known as amplitude estima- 
tion, to estimate efficiently the success probability a of quantum search 
algorithms. This is the natural quantum generalization of the above- 
mentioned technique to estimate the number of classical solutions to 
the equation f(x) = 1. 

The following table summarizes the number of applications of the given 
function / in the quantum algorithms presented in this paper. The table 
also compares the quantum complexities with the classical complexities of 
these problems, when the latter are known. Any lower bounds indicated 
(implicit in the use of the "6" notation) correspond to those in the black- 
box model of computation. In the case of the efficiency of quantum counting 
with accuracy e, we refer to the algorithm given below in the Appendix. 



Problem 


Quantum Complexity 


Classical Complexity 


Decision 




Q(N/(t + l)) 


Searching 


Q(VN/(t + i)) 


Q(N/(t + l)) 


Counting with error yft 


q(Vn) 




Counting with accuracy e 


\y Le*j+i L^j+i J 


0(±N/(t + l)) 


Exact counting 


Q(y/(t + l)(N-t+l)) 


Q(N) 
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We leave as open the problem of finding a quantum algorithm that 
exploits the structure of some searching or counting problem in a genuinely 
quantum way. By this, we mean in a way that is not equivalent to applying 
amplitude amplification or amplitude estimation to a classical heuristic. Note 
that Shor's factoring algorithm does this in the different context of integer 
factorization. 
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A Tight Algorithm for Approximate 
Counting 

Here we combine the ideas of algorithms Basic_Approx_Count and Ex- 
act_Count to obtain an optimal algorithm for approximately counting. That 
this algorithm is optimal follows readily from Corollary 1.2 and Theorem 1.13 
of Nayak and Wu Q. 

Theorem 18 Given a Boolean function f with N andt defined as above, and 
any e such that < s < 1, the following algorithm Approx_Count(/, e) 

outputs an estimate t such that 

\t-t\ < et 

with 'probability at least | ; using an expected number of evaluations of f in 
the order of 




N y/t(N - t) 

[et\ + 1 [et\ + 1 



lft = or t = N, the algorithm outputs t = t with certainty. 

We assume that eN > 1/3, since otherwise approximately counting with 
accuracy e reduces to exact counting. Set 
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and note that 5' G 0(5') where 5 is defined as in Theorem |TB|. The algo- 
rithm works by finding approximate values for each of the different terms in 
Equation [17]. The general outline of the algorithm is as follows. 



Algorithm( Approx_Count(/, e) ) 

1. Find integer L\ approximating a/ Nj (t + 1). 

2. Find integer L 2 approximating a/ (N — t)/ (sN). 

3. Set M 1 = ^(l + Lg). 

4. If Mi > y/N then find integer M 2 approximating yj(t + 1)(N -t + 1). 
If M t < y/N then set M 2 = 00. 

5. Set M = min{Mi, M 2 }. 

6. Set t' = Count (/, [IOttM]). 

7. Output an integer t satisfying \t — 1'\ < |. 



Proof To find Lj, we run steps 1 to 4 of algorithm Basic_Approx_Count 

and then set L\ = \9n x 2 l ~\ . A proof analogous to that of Theorem [15| gives 
that 



• Li > a/ N/ (t + 1) with probability at least 0.95, and 

• the expected value of L\ is in ©(a/ ' ^ I (* + !))• 

This requires a number of evaluations of / which is in O(-^i) , and thus, the 
expected number of evaluations of / so far is in 0(5'). 

In step 2, for some constant c to be determined below, we use 2|"^] 
evaluations of / to find integer L 2 satisfying 



L 2 > a/ (N — t)/ (eN) with probability at least 0.95, and 



the expected value of L 2 is in O (a/(A^ — t + 1)/ (eN) ) . 
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Since N — t = |/ _1 (0)|, finding such L 2 boils down to estimating, with 
accuracy in Q(y/e ), the square root of the probability that / takes the value 
on a random point in its domain. Or equivalently, the probability that -1/ 
takes the value 1, where -1/ = 1 — /. Suppose for some constant c, we 
run Count(-i/, |^]) twice with outputs f\ and f 2 . By Theorem [13], each 
output fj (i = 1, 2) satisfies that 



ft N - 1 



eN V eN 



2nk 4 N-t nk 
c V eN c 



with probability at least 1 — 2 ^_-^ for every k > 2. It follows that r = 

min { y/fi/ieN), ^Jf 2 /(EN)} has expected value in 0(y/(N -t + 1)/(eN)). 
Setting k = 21, c = 8nk, and L 2 = |~2f] + 1, ensures that L 2 satisfies the two 
properties mentioned above. The number of evaluations of / in step 2 is in 
G(^) which is in O(S'). 

In step g, we set M x = ^Li(l + L 2 ). Note that 



Mi > i (l + y^*J with probability at least 0.95 2 , and 

the expected value of M\ is in the order of ^ ^ ^1 + \J N ~ t 1 ^ 1 



In step |], analogously to algorithm Exact _Count, a number of evalua- 
tions of / in Q(\/N) suffices to find an integer M 2 such that 

• M 2 > y/(t + 1)(N -t + 1) with probability at least 0.95, and 



the expected value of M 2 is in Q(y/(t + 1)(N - t + 1) ). 



Fortunately, since \J(t + 1)(N — t + 1) > -y/iV, we shall only need M 2 if 
Mi > V^iV. We obtain that, after step 5, 



M is greater than 



mm 



N I N-t 



/i V t+ 1 V V eiv 

with probability at least 0.95 3 > 0.85, and 
the expected value of M is in O(S'). 
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To derive this latter statement, we use the fact that the expected value 
of the minimum of two random variables is at most the minimum of their 
expectation. 

Finally, by Theorem [13], applying algorithm Count(/, |~107rM~|) given 
such an M, produces an estimate if of t such that \if — 1\ < y (which implies 
that \i — 1\ < ei) with probability at least 8/n 2 . Hence our overall success 
probability is at least 0.85 x 8/tt 2 > 2/3, and the expected number of evalu- 
ations of / is in O(S'). □ 
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